Mobile Device Management (MDM) Explained — Security, Setup & Removal
MDM can enforce passcodes, encryption, app rules, network settings, and remote actions on work or school devices. This guide explains what administrators can see, how to verify management, how legitimate removal works, and where app locks, secure folders, encrypted vaults, and USB security keys fit.
MDM Security Desk Editorial TeamUpdated July 18, 202624-minute readOwner-safe guidance
Quick answer
Mobile device management is an administrative control layer used to apply security policies to enrolled phones, tablets, and computers. You can usually check enrollment in the device management settings. Removal must be performed by the owner or authorized administrator, and supervised or organization-owned devices may require the organization to release them. MDM is not a replacement for app-level privacy or encrypted storage.
An MDM service connects a management console to enrolled devices. The organization defines policies, and a platform service on the device applies them.
Depending on ownership and enrollment type, those policies can require a screen lock, enforce storage encryption, install work apps, configure Wi-Fi or VPN settings, restrict data sharing, report compliance status, or remotely lock and erase work data. On a personally owned device with a separate work profile, management is normally focused on the work container rather than the personal side.
MDM does not automatically hide personal photos, lock an individual banking app, or encrypt a private folder with a separate password. Those needs are handled by native secure folders, app locks, parental controls, or dedicated encrypted vault software.
What a policy checks
Screen lock enabled
Storage encrypted
OS version supported
Work apps configured
Device compliance reported
Data privacy in MDM depends on enrollment
On a fully managed corporate device, the organization can apply broad controls because it owns the device. On a bring-your-own-device setup, modern platforms can separate work and personal data. An Android Work Profile, for example, isolates work apps and data while leaving personal apps outside the managed container.
Before enrolling, read the disclosure shown by the operating system. It explains which controls the organization may use. If the device is personal, ask whether a work profile or user enrollment option is available instead of full-device management.
Three questions to ask
Who owns the device?
Which enrollment type is being used?
What data and actions can the administrator control?
Three direct answers
Common security questions, answered clearly
Mobile Device Management Policy Best Practices
Use the least-privileged enrollment type, require strong screen locks and encryption, keep OS versions current, separate work data, document remote-wipe rules, and review exceptions regularly.
Which device is used to provide security to mobile storage?
The device's secure hardware, such as a Secure Enclave, Trusted Execution Environment, or hardware-backed keystore, protects encryption keys. MDM configures policy but does not replace that hardware.
What is the best encryption for device security management?
Use the operating system's hardware-backed full-disk or file-based encryption, managed through supported platform controls. For separate private files, use a reputable vault that applies modern authenticated encryption.
Search-intent selector
What are you trying to do?
Start with the device status audit, then use the platform selector for owner-authorized steps.
My situation is
Choose the path that matches your device
Employer-managed device
Do not try to bypass management. Review the enrollment disclosure and ask IT whether the device is fully managed or uses a separate work profile. For removal, follow the organization's offboarding process.
Native controls should form the base layer because they are integrated with the operating system and hardware-backed key storage.
Easy · 5-10 min
Install current OS and security updates. Updates close known vulnerabilities and keep management APIs compatible.
Use a strong device passcode. A longer PIN or password is safer than a short pattern. Biometrics should unlock a device already protected by a strong fallback credential.
Confirm storage encryption. Modern iPhone and Android devices normally encrypt storage by default when a screen lock is set, but managed environments should verify compliance.
Enable loss protection. Turn on the platform's device-finding service, remote lock, and account recovery options.
Separate work from personal data. Prefer Android Work Profile or Apple's user-focused enrollment where available for personally owned devices.
Best for
Every user, every device, and every organization. This is the minimum security layer.
Limitations
A device screen lock does not stop someone from opening a sensitive app after you hand them an already unlocked phone.
Audit current state
How do I know if MDM is on my phone?
Check the device settings, look for a work profile or management disclosure, and confirm which organization enrolled the device.
Easy · 3 min
Platform selector
Choose your device
Check on iPhone or iPad
Open Settings.
Go to General, then VPN & Device Management.
Open any listed management profile and read the organization name and restrictions.
If the section is absent and no profile is listed, a configuration profile is not installed through that menu.
Check on Android
Open Settings and search for work profile, device admin apps, or device management.
Look for apps with a briefcase badge, a Work tab, or an Android Device Policy entry.
Open the work profile settings to see the managing organization and controls.
Menu names vary by manufacturer and Android version.
Check on Samsung Galaxy
Open Settings and search for Device admin apps and Work profile.
Check Accounts and backup for a managed work account.
Do not confuse Samsung Secure Folder with MDM. Secure Folder is a private container, not proof that an organization manages the device.
Verification note: A management app icon alone is not enough to prove active enrollment. Open system management settings and verify the enrolled organization, profile status, and work container.
0 of 5 checks completed
MDM removal
Can an MDM lock be removed?
Yes, when the device owner or authorized administrator follows the supported unenrollment path. Some supervised or organization-owned devices cannot be released by the user alone.
Moderate · varies
Can you remove MDM from iPhone or iPad?
If the profile is user-removable, open Settings, General, VPN & Device Management, select the profile, and use Remove Management or Delete Profile. You may need the device passcode or a removal password. If the control is unavailable, the device may be supervised or require administrator removal.
How to disable MDM on Samsung or Android
For a personal device with a removable Work Profile, use the work profile settings to remove the profile and its work data. For a fully managed or company-owned device, contact the administrator to retire or unenroll it from the management console.
I bought a used device with MDM
Ask the seller or previous organization to remove the device from its management and automated enrollment records. Keep the purchase receipt and device identifiers. If the seller cannot release it, return the device. Factory reset alone may not remove automated enrollment.
Safety boundary: This guide does not provide bypass, cracking, credential extraction, or unauthorized removal instructions. For a device you own, use documented account recovery, proof of purchase, vendor support, or the managing organization's release process.
Best for
Offboarding, personal-device work profile removal, school graduation, device resale, or correcting accidental enrollment.
When it will not work
A supervised device, locked enrollment, organization-owned device, or device assigned through automated enrollment may require server-side release.
How mobile app locking works
Biometric vs PIN app locking: pros and cons
App locks protect selected apps after the phone is already unlocked. They are a privacy layer, not a substitute for device encryption, MDM policy, or account security.
The score reflects everyday privacy, not formal certification.
Editorial rating
4.2/5
Biometric app lock
Fast and resistant to casual shoulder-surfing. Security depends on the phone's biometric hardware and the strength of the fallback passcode.
Convenience
4.7
Privacy
4.3
Recovery
3.6
Method
Strength
Weak point
Best for
Recommendation
Biometric
Fast, not easily observed
Depends on fallback credential
Frequent daily access
Use with a strong PIN or password
PIN
Reliable and widely supported
Can be observed or guessed if short
Balanced privacy
Use 6 or more non-obvious digits
Pattern
Quick and memorable
Easy to observe and trace
Low-risk convenience
Avoid simple shapes
Password
Highest potential entropy
Slow on a phone
High-sensitivity vaults
Use a unique passphrase
App lock after phone restart
Many app locks require the device passcode or app master credential after restart before biometrics work again. Some third-party locks may not protect apps until the operating system has fully loaded required permissions.
App lock after an OS update
Updates can reset background, accessibility, overlay, or battery permissions. Test every protected app after updating and check notifications, recents, split screen, and deep links.
Split-screen and notification privacy
An app lock may block the main app while notifications or recent-app thumbnails still expose information. Hide sensitive notification previews separately.
Biometric spoofing risk
Use the strongest biometric class available and keep a strong fallback credential. For high-sensitivity data, require the master password periodically or after restart.
Secure folder app
How secure folders differ from regular folders on mobile
Option
What it protects
Separate encryption or container
Can hide apps
Works across brands
Best use
Built-in and dedicated privacy layers
Regular folder
Organization only
No
No
Yes
Non-sensitive files
Phone screen lock
Whole device while locked
Device encryption
No
Yes
Baseline security
Samsung Secure Folder
Apps, files, and accounts inside a Samsung container
Yes, hardware-backed Knox environment
Yes
No
Strong native privacy on compatible Galaxy devices
Third-party app lock
Selected app launch
Usually no separate app-data encryption
Sometimes
Mainly Android
Casual access prevention
Encrypted vault app
Imported photos, videos, documents, notes, and credentials
Yes, when implemented correctly
May include app locking
Varies
Private files needing a separate vault
Verdict
Use Samsung Secure Folder on a compatible Galaxy device for a native container. Use a reputable encrypted vault for cross-device file protection or features beyond the native container.
Samsung Secure Folder vs third-party app locks: Secure Folder creates a separate protected environment. A basic app lock usually places an authentication gate in front of an existing app but may not isolate or encrypt that app's data separately.
How to hide the app lock itself from the home screen
Use the app's documented stealth or icon-hiding option only if it preserves recovery access. Removing an icon is not a security control by itself because installed apps can still be found through system settings.
The tool we recommend for private files
Use MDM for policy, then choose the right Folder Lock edition for private data
We do not recommend it as a substitute for MDM. It cannot enroll a fleet, enforce organization-wide compliance, deploy work apps, apply conditional access, or remotely retire employee devices. Folder Protect is also a separate Windows access-control product rather than an encrypted mobile vault.
The fit changes by operating system. Android combines a protected vault with an app-launch gate. The iPhone and iPad edition focuses on vault content, local transfer over Wi-Fi, cloud workflows, and attempt monitoring. Windows and macOS add local and cloud lockers, while the Windows edition has the broadest set of portable and file-management tools.
Folder Lock is useful after the device policy layer is already in place. It gives an individual user a separate space for private media, documents, notes, credentials, and other records that should not remain exposed in ordinary apps or folders.
Android app gateiPhone Wi-Fi transferDesktop and cloud lockersFree and Pro limits
The product family shares an encrypted-vault idea, but the available tools are not identical. Choose the edition by the device and the job instead of assuming the Windows, Mac, Android, and iPhone apps behave the same way.
A
Android
Vault plus app locking
Best for people who want one protected area for media, documents, audio, notes, wallet records, and passwords, plus a second prompt before selected apps can open.
Includes an app-locking tool that is specific to the Android edition.
Can record failed access attempts and includes a browser designed to avoid retaining its own browsing history.
May request media or file access and an additional Android permission so the app gate can appear over other apps.
Watch for: Android updates, battery controls, or revoked special access can interrupt app locking even when the encrypted vault remains available.
i
iPhone and iPad
Vault plus local transfer
Best for private photos, video, documents, audio, notes, and financial records when the user also wants to move files between the Apple device and a computer without relying only on a cable or cloud service.
Offers Wi-Fi based file transfer to a computer on the same trusted network.
Supports cloud backup, cross-device access, a private browser, and failed-attempt monitoring.
The supplied iPhone material does not list a system-wide locker for arbitrary third-party apps.
Watch for: Use iOS app-specific locks or the operating system's own app-hiding and Face ID controls when the goal is to restrict another installed app.
W
Windows
Broadest desktop toolset
Best for encrypted local folders, protected cloud-synced storage, portable lockers, selected sharing, file hiding, secure deletion, and removal of local activity traces.
Provides a local locker and separate locker workflows for Dropbox, Google Drive, and OneDrive.
Pro adds capabilities such as encrypted sharing, portable lockers, and folder protection according to the published comparison.
People receiving a shared encrypted item need compatible Folder Lock software and the required access credential.
Watch for: A desktop locker protects files placed in its managed location. It does not turn the Windows PC into a managed endpoint or apply policy to employee phones.
M
macOS
Local and cloud lockers
Best for Mac users who need an encrypted desktop location, protected cloud folders, cross-device synchronization, and controlled sharing inside the Folder Lock ecosystem.
The supplied Mac material specifies macOS 13 or later.
Free storage is listed separately for the local, Dropbox, Google Drive, and OneDrive lockers.
Sharing and the Secrets area are listed as Pro capabilities on the Mac comparison.
Watch for: Cloud availability still depends on the selected provider, the user's account, network access, and a correctly configured locker.
Capability
Android
iPhone/iPad
Windows
macOS
Protected media and documents
Yes
Yes
Through lockers
Through lockers
Notes and wallet-style records
Yes
Yes
Secrets area
Pro Secrets area
Lock other installed apps
Yes, with Android system access
Not listed in supplied product material
Not the desktop product's purpose
Not the desktop product's purpose
Wi-Fi transfer to a computer
Not highlighted
Yes
Computer endpoint
Computer endpoint
Local encrypted locker
Mobile vault
Mobile vault
Desktop Locker
Desktop Locker
Dropbox, Google Drive, OneDrive lockers
Backup and sync support
Backup and sync support
Dedicated cloud lockers
Dedicated cloud lockers
Portable encrypted locker
Not a mobile workflow
Not a mobile workflow
Pro feature
Not highlighted in supplied Mac material
MDM enrollment and compliance
No
No
No
No
Product capabilities in context
What Folder Lock adds beyond the phone screen lock
The useful features are the ones that protect a specific data path. Each item below includes the boundary that should be understood before relying on it.
The mobile apps organize imported photos, video, documents, audio, notes, and wallet-style records inside the application's protected area. Desktop editions use local or cloud-connected lockers. This is stronger than moving files into an ordinary hidden folder, but only content added to the protected location receives the vault's protection.
The Android edition can place a PIN or master-credential prompt in front of selected apps. It may need special Android access to detect launches and display the blocking screen. Review those permissions after major OS updates and test behavior after a restart.
The iPhone and iPad material emphasizes moving vault files between the mobile device and a computer over a trusted local network. It does not describe an iOS-wide feature for placing Folder Lock in front of every other app, so app-specific or native iOS controls remain necessary.
Windows and Mac users can keep data in a local desktop locker or use lockers associated with Dropbox, Google Drive, and OneDrive. Turning synchronization off keeps data in the local locker. Turning it on adds the cloud provider and account to the availability and recovery chain.
The desktop product can give approved recipients their own access credentials instead of passing around the owner's password. The receiving person still needs compatible Folder Lock software, so it is not a universal encrypted-link service.
Mobile editions can record failed unlock activity, with the exact evidence depending on platform permissions. The built-in browser is designed not to retain its own cookie and history trail, but it does not make the network connection anonymous or replace phishing protection.
Account or application-password recovery is not the same as recovering every independent encrypted locker. Older locker documentation warns that a forgotten locker password may be unrecoverable. Create a small test locker, record the exact recovery route for the installed version, and keep an independent backup before deleting originals.
At a glance
App lock vs phone screen lock: which is enough?
Method
Difficulty
Security
Cost
Best for
Limitations
Device and policy controls
Phone screen lock
Easy
High baseline
Free
Lost or unattended device
No protection after you unlock and hand over the phone
MDM
Admin setup
High for policy enforcement
Usually business-paid
Corporate compliance and remote actions
Not a personal private vault
Parental controls
Easy to moderate
Policy-based
Often built in
Child accounts, time and content limits
Not designed to encrypt private files
App and file privacy
Native secure folder
Easy
Strong on supported devices
Free
Separate apps and files
Platform or brand limited
Third-party app lock
Easy
Moderate
Free or paid
Casual app access prevention
Permission and reliability vary
Folder Lock vault
Easy to moderate
Strong for imported private files
Free and paid options
Cross-device private storage
Not an MDM platform
Verdict
For most people, use all three layers: strong device lock, platform security or MDM where appropriate, and a separate secure folder or encrypted vault for especially sensitive files and apps.
Step by step
How to add Folder Lock without weakening your MDM setup
Choose the edition by platform and outcome. Use Android when app locking matters, iPhone or iPad when the vault and local Wi-Fi transfer fit the need, and a desktop edition for local or cloud lockers.
Install from the official product page or platform store. Verify the developer and avoid modified installers. On a managed device, confirm that organizational policy permits a personal vault application.
Create a unique master credential and configure recovery immediately. Do not reuse the phone PIN, MDM enrollment password, company account password, or banking credential. Record which recovery method applies to the exact edition.
Grant only the permissions required for the chosen feature. Android app locking may need additional system access, while media import needs file or photo permission. Decline unrelated permissions and review them after updates.
Build a small test vault before moving important data. Import copies, close and reopen the app, restart the device, and confirm that files remain readable before removing any original.
Choose local, cloud, or Wi-Fi transfer deliberately. A local locker reduces provider dependency. Cloud lockers add synchronization and recovery options. iPhone Wi-Fi transfer should be used only on a trusted local network.
Test the complete lifecycle. Verify behavior after OS updates, MDM policy changes, device replacement, password changes, backup restoration, and account sign-out.
MDM can configure security settings, distribute work apps, check compliance, and trigger remote actions. Exact reach depends on platform, ownership, enrollment, and administrator policy.
Modern mobile operating systems protect encryption keys through secure hardware and tie access to the device credential. MDM can require or verify encryption, but the operating system and secure hardware perform it.
Containers separate data and apps. Android Work Profile separates work from personal use, while Samsung Secure Folder creates a private Samsung container. They solve different management and privacy problems.
An app lock controls entry to selected apps. An encrypted vault protects items imported into its own storage. A product can provide both, but the security properties are not identical.
A FIDO2 security key is a purpose-built authenticator. A normal USB flash drive is storage. Windows can use a flash drive for a BitLocker startup key, but that does not turn it into a FIDO2 authenticator.
Limitations and product boundaries
What Folder Lock, Folder Protect, and Folder Lock Lite cannot replace
They are not MDM platforms
None of these products enrolls a company fleet, pushes device configuration, evaluates compliance, deploys managed work apps, applies conditional access, or performs administrator-led selective wipe.
Features differ by operating system
Android has the app-launch gate. The iPhone edition highlights Wi-Fi transfer instead. Windows provides the widest portable and cleanup toolset. The Mac edition requires a current macOS release and has its own plan limits.
Cloud sync adds external dependencies
A cloud locker remains dependent on the selected provider, the user's provider account, available storage, network access, and correct synchronization settings. Keep a separate recovery plan.
App locking is not app-data isolation
An Android launch prompt can discourage casual access, but it is not the same as a hardware-backed work profile or Samsung Secure Folder. Notifications, previews, deep links, and update behavior still need testing.
Folder Protect is access control, not encryption
Folder Protect is a Windows product for making items unavailable, hidden, resistant to changes, or resistant to deletion. It can also protect programs and file-type patterns. It should not be described as an encrypted mobile vault.
Folder Lock Lite is a reduced legacy option
The supplied Lite material describes a smaller Windows edition centered on locking and hiding folders without the encryption features of the full Folder Lock product. It is not suitable where encrypted-at-rest storage is required.
Recovery may not cover every locker
A recovered account or app password does not guarantee recovery of an independently encrypted container. Verify the behavior of the installed version, retain recovery material, and keep a separate backup.
The private browser is not anonymity software
A browser that avoids retaining its own local history can reduce traces on the device. It does not hide traffic from the network, prevent account tracking, or replace a trusted browser with anti-phishing protection.
Enrollment capability
MDM enrollment types: user, device, and supervised
Enrollment model
Typical ownership
Management reach
Personal privacy
Removal path
User or account-focused enrollment
Personal device
Managed work apps, accounts, and data
Strong separation expected
User unenrollment or admin offboarding
Android Work Profile
Personal or company-owned
Work container policies
Personal profile remains separate
Remove work profile when permitted
Device enrollment
Company or school device
Broader device settings and apps
Limited personal-use expectation
Administrator retirement or supported removal
Supervised or fully managed
Organization-owned
Strongest restrictions and remote control
Treat as organizational
Organization must release or unenroll
Dedicated or kiosk
Organization-owned
Locked to approved apps
Not intended for personal use
Administrator only
Enterprise MDM and security
Mobile Device Management Policy Best Practices
01
Choose the least intrusive enrollment
Match control depth to ownership. Use a work container for BYOD and full management for organization-owned devices.
02
Define a minimum security baseline
Require a strong screen lock, supported OS version, encryption, secure boot where available, and automatic updates.
03
Separate work and personal data
Block unmanaged app sharing only where needed. Document screenshot, clipboard, backup, and file-transfer restrictions.
04
Use conditional access
Grant access based on identity, compliance, risk, and application context instead of trusting enrollment alone.
05
Plan loss, theft, and offboarding
Define when to lock, selectively wipe work data, fully erase corporate devices, revoke tokens, and preserve evidence.
06
Review privacy and exceptions
Tell users what is collected, retain only necessary telemetry, review exemptions, and audit high-privilege administrators.
Enterprise software that standardizes security settings across employee laptops
For laptops, the broader category is unified endpoint management or endpoint management rather than mobile-only MDM. A central policy service configures encryption, firewall, updates, application controls, identity, and compliance. Mobile and desktop policies should share a common baseline while accounting for platform differences.
Enterprise version control security requirements
Version-control access should rely on managed identities, phishing-resistant multifactor authentication, least privilege, protected branches, signed commits where appropriate, secret scanning, and rapid credential revocation. MDM helps establish device posture, but repository controls remain necessary.
Small-business starting point: Inventory devices, separate company and personal accounts, require encryption and strong screen locks, enable automated updates, choose a management platform with selective wipe, and document employee offboarding.
Protecting financial apps
App lock for banking and financial apps specifically
Banking apps already use account authentication, device binding, session timeouts, and fraud controls. Add a device-level screen lock first, then enable the banking app's own biometric login and transaction alerts. A separate app lock can reduce casual access when you lend an unlocked phone, but it should not interfere with the bank app's controls.
Hide transaction details in notifications and on the lock screen.
Use a unique banking credential and secure account recovery.
Do not store card PINs or one-time codes in ordinary notes or screenshots.
Keep finance apps out of unsecured device backups where possible.
Test app-lock behavior after restart, update, and biometric changes.
Do not weaken the bank app: Avoid accessibility-based app locks that request more access than necessary, and never install modified banking applications.
Child safety
How to lock apps for kids using parental controls
Parental controls are usually better than a generic app lock for child devices because they can apply age restrictions, time limits, purchase approval, content filters, location sharing, and downtime through a managed child account.
Create a child account using the platform's family system.
Set age-appropriate app and content limits.
Require approval for purchases and new installs.
Use scheduled downtime and communication limits.
Protect the parent recovery account with strong multifactor authentication.
A parental-control PIN should differ from the child's device passcode. Explain the rules openly when age-appropriate rather than relying only on hidden monitoring.
Privacy settings audit
Best mobile privacy settings you should enable now
USB security management
Can I use a regular USB as a security key?
A normal USB flash drive cannot simply be converted into a FIDO2 security key. A FIDO security key contains purpose-built cryptographic hardware and firmware. Windows can store a BitLocker startup key on a USB flash drive, but that is a different function.
USB use
What it does
Can a regular flash drive do it?
Security note
FIDO2 security key
Phishing-resistant sign-in and multifactor authentication
No, use certified authenticator hardware
Private keys remain in the authenticator
BitLocker startup key
Stores a startup key file used during Windows boot
Yes, when configured through supported BitLocker policy
On supported Windows editions, administrators can configure BitLocker to use a startup key stored on a USB flash drive. Follow Microsoft documentation and organizational policy. This is not the same as creating a Microsoft account security key, and it does not make the drive FIDO2-capable.
Windows security event ID 6416 and USB devices
Security event 6416 can record recognition of a new external device when the relevant audit policy is enabled. Enterprise teams can combine device-control policy, inventory, endpoint detection, and log review to identify unauthorized USB use.
USB port security lock devices for office use
Physical port blockers can reduce casual access, but they should support, not replace, endpoint policy. Business controls should define allowed device classes, exception approval, write access, and encrypted-drive handling.
Clear distinction: FIDO2 authentication keys protect account sign-in. USB Secure protects data stored on USB drives. USB Block controls whether removable devices can connect. These tools solve different problems.
Choose the correct layer
MDM, secure folder, app lock, and Folder Lock compared
Capability
MDM platform
Samsung Secure Folder
Basic app lock
Folder Lock
Enforce fleet policy
Primary purpose
Not supported
Not supported
Not supported
Separate work and personal data
Supported by enrollment model
Private Samsung container
Usually no
Private vault, not work policy
Lock selected apps
Can restrict or configure apps
Apps can be installed inside container
Primary purpose
Supported on Android product
Encrypt private imported files
Relies on OS and managed apps
Inside Secure Folder
Usually not
Primary privacy use
Cross-platform private vault
Vendor-dependent work apps
No
Usually no
Mobile and desktop product family
Best fit
Organizations
Samsung owners
Casual app privacy
Private files and vault workflows
Verdict
Do not select one tool for every job. Use MDM for governance, secure containers for isolation, app locks for casual access control, and encrypted vaults for sensitive personal files.
Free and Pro comparison
Folder Lock pricing and limits by platform
The supplied product pages list a free option and a Pro price of $39.95, but the plan details are not identical on every platform page and the billing term is not stated consistently in the research. Treat the figures below as the published comparison snapshot and confirm the current checkout or in-app offer before purchase.
Edition
Free snapshot
Pro snapshot
Important interpretation
Windows
1 GB locker allowance, 2 synced devices, mobile apps and Secrets listed
The comparison lists $0 and $39.95. Secure deletion and history cleaning appear in both columns.
macOS 13+
1 GB each for the desktop and three named cloud lockers, 2 synced devices, no sharing or Secrets in the chart
Unlimited locker allowances, 5 synced devices, sharing, and Secrets
Both desktop and mobile companion apps are listed for each plan.
Android
1 GB and 2-device limits are shown
Unlimited locker size and 5-device limit are shown
The mobile page reuses several desktop-oriented rows. Confirm which paid features are delivered by the Android app itself.
iPhone and iPad
1 GB and 2-device limits are shown
Unlimited locker size and 5-device limit are shown
The iOS feature list highlights Wi-Fi transfer rather than Android-style app locking.
Folder Protect
Evaluation or trial language is used
Separate Windows license
This is a different product for access restrictions, not an upgrade tier for the mobile vault.
Folder Lock Lite
Reduced legacy feature set
Separate legacy purchase path in the supplied material
Locking and hiding are emphasized; encryption is specifically excluded from the Lite description.
Suggested starting point
Free Folder Lock edition
$0
Use copies of non-critical files to test login, import, restart behavior, recovery, and restore. Do not remove original files until the complete recovery route has been proved.
Supervision, locked profile, or administrator restriction
Contact the managing organization and request server-side retirement or release.
MDM returns after factory reset
Device remains assigned in automated enrollment
Ask the seller or organization to remove the device from its enrollment account.
Work apps remain after unenrollment
Work profile was not fully removed or cached accounts remain
Use Remove Work Profile, restart, then review accounts and certificates.
App lock stops after update
Background, overlay, accessibility, or battery permission changed
Reopen the app lock, review permissions, and test every protected app.
Forgot app lock PIN
Recovery was not configured or account changed
Use documented recovery, linked account, saved recovery key, purchase record, or vendor support.
Secure Folder reset is missing
Samsung account reset was not enabled or account access is unavailable
Follow Samsung's official recovery guidance and verify the associated Samsung account.
Notifications reveal locked app content
App lock does not control notification previews
Hide sensitive notification content in operating-system settings.
USB security key prompt appears
An account expects a registered hardware key
Insert the registered FIDO key or use account recovery. A random USB drive will not work.
Which option is right for you?
Choose by the risk you are solving
Employee using a personal phone
Recommended: Work Profile or user-focused enrollment, strong device lock, and a separate personal vault if needed. Alternative: A company-owned device when policy requires full control.
Parent managing a child's device
Recommended: Built-in family and parental controls. Alternative: App lock only for a few adult-owned apps on a shared device.
Samsung owner protecting private apps and files
Recommended: Samsung Secure Folder. Alternative: Folder Lock when cross-platform vault features are more important.
Small business securing company phones
Recommended: MDM or unified endpoint management with least-privilege enrollment, conditional access, and documented offboarding. Folder Lock can protect selected files but is not the management platform.
User moving private files between phone, PC, cloud, and USB
Recommended: A consistent encrypted vault and portable-storage strategy. Use Folder Lock for file vault workflows, USB Secure for protected USB data, and a real FIDO2 key for account authentication.
Common reader outcomes
What a good setup looks like in practice
The following are composite scenarios, not customer testimonials.
“A consultant separates client work in a managed work profile, keeps personal documents in an encrypted vault, and can remove company access without erasing family photos.”
“A parent uses a child account for app limits and purchase approval instead of hiding a generic app lock the child can disable.”
“A Samsung owner uses Secure Folder for a second copy of finance and messaging apps, then hides notification previews outside the container.”
“A small business uses MDM for encryption and remote wipe, while staff store particularly sensitive files inside approved encrypted applications.”
Related security tools
Other security tools from the same developer
These tools are developed by NewSoftwares.net, the same team behind Folder Lock. Each addresses a different layer.
App Lock
Android-focused app access control and gallery privacy for users who do not need the full desktop locker workflow.
MDM, app lock, secure folder, and USB security questions
What is MDM, Mobile Device Management Security?
MDM is a system for enrolling devices, applying configuration and security policy, distributing work apps, checking compliance, and performing authorized remote actions such as lock or wipe.
How does MDM security work?
An administrator defines policy in a management console. A platform management service on the enrolled device receives and applies supported commands. Capability depends on ownership, platform, enrollment, and policy.
Is MDM safe?
MDM is a standard enterprise security approach when configured transparently and with least privilege. Risk increases when organizations over-collect data, use full management on personal devices without need, or fail to protect administrator accounts.
Can you remove MDM from iPhone?
A removable profile can be deleted in Settings, General, VPN & Device Management. A supervised or locked profile may require the administrator to unenroll or release the device.
Can an MDM lock be removed?
Yes, through authorized unenrollment, administrator retirement, seller release, or supported owner recovery. Factory reset may not remove automated enrollment assignment.
What is the best free app lock for Android?
Start with the phone maker's built-in private space, secure folder, or app lock when available. For a third-party app, choose one from the official store with limited permissions, clear recovery, recent maintenance, and transparent privacy practices.
Can you lock individual apps on iPhone without Screen Time?
Some apps provide their own Face ID or passcode lock. Current iOS versions may also offer system options to require Face ID or hide an app on supported devices. Availability varies by version and app.
How does fingerprint app locking work?
The app asks the operating system to verify an enrolled biometric. The app normally receives a success or failure result, not the fingerprint image. A device or app credential remains the fallback.
Is biometric app locking more secure than PIN?
Biometrics are convenient and hard to observe, while a strong PIN or password is essential as the fallback. The best setup combines strong hardware-backed biometrics with a non-obvious credential.
What is the difference between Samsung Secure Folder and an app lock?
Secure Folder creates a separate protected container for apps, accounts, and files. A basic app lock usually adds an authentication gate before opening an existing app without creating a separate container.
Can someone bypass app lock by restarting the phone?
A well-designed lock should protect apps after restart, but third-party behavior varies. Test it. The device passcode often becomes mandatory before biometrics work, and some apps need background permissions restored.
How do I recover access if I forgot my app lock PIN?
Use the product's official recovery option, linked account, saved recovery key, license email, or vendor support. Do not use tools that promise to crack or extract credentials.
What is a USB security key?
A USB security key is usually a purpose-built FIDO authenticator that proves possession of a cryptographic key during sign-in. It can provide phishing-resistant multifactor or passwordless authentication.
Can I use any USB as a security key?
No for FIDO2 authentication. A standard flash drive lacks the required authenticator hardware and firmware. It may be used for a supported BitLocker startup key, which is a different function.
How do I insert a security key into a USB port?
Use the registered hardware key that matches the port or an approved adapter. Insert it when prompted, then touch or unlock the key if required. If you do not own the registered key, use the provider's recovery process.
Which device is used to provide security to mobile storage?
The phone or tablet's secure hardware and operating-system keystore protect encryption keys. MDM enforces policy and checks compliance, while the device performs encryption.
What is the best encryption for device security management?
Use supported hardware-backed full-disk or file-based encryption built into the platform, plus modern encrypted application containers for data that needs additional separation.
Does Folder Lock replace mobile device management?
No. Folder Lock protects selected private data and, on Android, can gate selected apps. It does not enroll devices, enforce corporate configuration, distribute managed apps, measure compliance, or perform administrator-controlled wipe.
Is Folder Lock App Locker available on iPhone?
The supplied Android material lists an App Locker, while the iPhone material highlights Wi-Fi transfer instead. On iPhone, use the operating system's app-hiding or Face ID controls, Screen Time where appropriate, or an app's own authentication setting.
What permissions can Folder Lock need on Android?
Photo, media, camera, notification, or broad file access may be requested depending on the feature. App locking may also require a special system permission so the blocking prompt can appear when another app launches. Grant only what you use and review access after updates.
How are Folder Lock and Folder Protect different?
Folder Lock centers on encrypted lockers, mobile vault content, cloud-connected lockers, and related privacy tools. Folder Protect is a Windows access-control utility that can hide items or prevent opening, editing, or deleting them. Folder Protect should not be presented as encrypted mobile storage.
Does Folder Lock Lite encrypt files?
The supplied Lite description says the reduced edition provides folder locking but omits the encryption features. Use the full encrypted-locker product when protection at rest is required.
Can I share an encrypted file with someone who does not have Folder Lock?
The supplied sharing documentation says the recipient needs Folder Lock and the required credential to open the protected item. Plan the recipient workflow before using it for collaboration.
What happens if I forget a locker password?
Recovery depends on the edition, account, and type of locker. Older locker documentation warns that an independent locker password may not be recoverable. Test recovery with a non-critical locker and keep a separate backup.
What are the published Free and Pro limits?
The supplied comparisons commonly show 1 GB and 2 synced devices for Free, with unlimited locker capacity and 5 devices for Pro. Mac, Windows, Android, and iPhone tables differ in feature rows, so verify the current platform-specific checkout.
More on this topic
In-depth answers by platform and problem
How can mobile security apps protect mobile device data?
They can scan for risky apps, block malicious links, protect network traffic, lock private content, or report device posture. No single app covers every layer. Evaluate permissions, update history, recovery, data handling, and platform integration.
Mobile device screen lock security benefits
A screen lock protects encryption keys, prevents casual access, and enables lost-device locking. Longer credentials improve resistance to guessing. Biometrics improve usability but do not remove the need for a strong fallback.
Explain how to protect a mobile device from theft
Use a strong passcode, enable device finding and remote lock, keep account recovery secure, hide notification content, record the device serial, avoid unattended charging points, and report theft quickly.
How to password protect photos on Android without an app
Use the phone maker's built-in secure folder, private space, locked folder, or gallery protection where available. Confirm whether media is separately encrypted, excluded from cloud backup, and removed from the ordinary gallery.
Mobile device security for small business
Begin with inventory, supported OS versions, strong identity, encryption, selective wipe, work-data separation, incident response, and documented offboarding. Add MDM when manual management no longer provides consistent enforcement.
Corporate mobile device security
Use conditional access, managed applications, certificate-based network access, phishing-resistant authentication, data-loss rules, mobile threat signals, and clear privacy disclosures. Test policy changes before broad deployment.
Mobile device security risk myth
The myth is that modern phones are automatically secure because they use sandboxing and encryption. Those controls are strong, but outdated software, stolen credentials, risky permissions, phishing, unmanaged backups, and poor recovery can still expose data.
You cannot turn a generic flash drive into a certified FIDO2 authenticator with a simple file or Windows setting. Purchase compatible authenticator hardware for account security. Use BitLocker startup-key configuration only for its documented Windows boot purpose.
USB write protection and device security
Write protection can reduce accidental or malicious modification, while encryption protects confidentiality. Enterprise USB policy should also control allowed devices, data direction, malware scanning, and exception approval.
FIDO2 security key USB authentication device
FIDO2 keys use public-key cryptography and origin binding, which helps resist phishing. Register at least two keys or configure secure recovery so loss of one key does not lock you out.
USB disk security key vs encrypted USB drive
A security key authenticates a user to an account. An encrypted USB drive stores protected files. They may share a connector but have different hardware, protocols, and threat models.
Folder Lock Android vs iPhone
Both editions provide a protected space for personal content and support cloud-oriented workflows. Android adds the ability to gate other apps after receiving the required system access. The iPhone edition instead emphasizes local Wi-Fi transfer between the device and a computer.
Folder Lock Windows vs Mac
Both desktop editions support local and named cloud lockers. Windows includes the broader set of portable, folder-protection, shredding, and history-cleaning tools. The Mac material specifies macOS 13 or later and lists sharing and Secrets under Pro.
Folder Lock vs Folder Protect
Choose Folder Lock when encrypted storage and cross-device locker workflows are central. Choose Folder Protect when a Windows user needs granular restrictions such as allowing a file to be viewed but not changed or deleted.
Folder Lock Lite limitations
The Lite material describes a smaller lock-and-hide product without the encryption functions of the full Folder Lock edition. It should not be recommended for compliance requirements that call for encrypted storage.
MDM is the right tool for organizations that need consistent policy, compliance checks, work-data separation, and authorized remote actions. It should be deployed according to ownership and privacy needs, with the least intrusive enrollment that still meets the risk.
For personal privacy, start with a strong device passcode, hardware-backed encryption, current software, hidden notification previews, and the platform's secure folder or private space. Add an app lock for casual access control and an encrypted vault when particularly sensitive files need a separate credential or cross-device workflow.
Folder Lock is a practical recommendation for private file vaults and related mobile privacy features, but it does not replace an enterprise MDM service. Use each layer for the problem it was designed to solve.
